CVE-2015-2039

2015-02-2016:59:08

CWE-352

[email protected]

web.nvd.nist.gov

cve-2015-2039

csrf

cross-site request forgery

acobot

wordpress

nvd

vulnerabilities

security

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

6.8 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

48.9%

JSON

Multiple cross-site request forgery (CSRF) vulnerabilities in the Acobot Live Chat & Contact Form plugin 2.0 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change plugin settings or (2) conduct cross-site scripting (XSS) attacks via the acobot_token parameter in the acobot page to wp-admin/options-general.php.

Affected configurations

NVD

Node

acobot_live_chat_\&_contact_form_projectacobot_live_chat_\&_contact_formMatch2.0wordpress

CPENameOperatorVersion
acobot_live_chat_\&_contact_form_project:acobot_live_chat_\&_contact_formacobot live chat & contact form project acobot live chat & contact formeq2.0